Snarky Spider

SNARKY SPIDER, also tracked as O-UNC-025 and UNC6661, is a financially motivated, native English-speaking cybercrime group first observed in October 2025. It is affiliated with The Com and conducts rapid data-theft and extortion operations, primarily against U.S. organizations. Targets include law firms and organizations in aviation, retail, hospitality, automotive, financial services, technology, and academia. It shares substantial tradecraft with CORDIAL SPIDER but is tracked as a distinct actor. The group impersonates corporate IT personnel through voice phishing and directs employees to single sign-on-themed adversary-in-the-middle phishing pages. These capture credentials, MFA codes, and session tokens, enabling access to identity providers and connected SaaS applications, including Microsoft 365 and Google Workspace. SNARKY SPIDER abuses SSO trust relationships to access multiple cloud services while operating almost exclusively within SaaS environments. In one intrusion, it progressed from account takeover to data theft in less than five minutes. For persistence, SNARKY SPIDER manipulates MFA enrollment and registers attacker-controlled devices, favoring Genymobile Android emulators. It suppresses security notifications through email deletion and inbox rules, and uses VPNs and residential proxies to obscure its location and evade IP-based detection. Its operations involve searching cloud applications for sensitive information and rapidly downloading valuable datasets for extortion. The group has also used aggressive victim harassment, including swatting employees of targeted organizations.